Summary

Three text-walker rules — pii-redact, secrets-redact, and encoded-payload-redact — duplicated the same five-primitive lifecycle around a one-line difference in collectMatches:

const lifecycle = new ReusableAbortController();
let unsubscribeRouteChange: (() => void) | null = null;
function scanAndMask(root) { walkTextNodesChunked(root, { signal, minLength, process }); }
const watcher = createSubtreeWatcher({ skipPlaceholderSubtrees: true, onSubtrees });
function apply(root) { unsubscribeRouteChange ??= subscribeRouteChange(...); scanAndMask(root); watcher.start(root); }
teardown: () => { watcher.stop(); lifecycle.abortAndReset(); unsubscribeRouteChange?.(); unsubscribeRouteChange = null; }

The new defineInlineTextRedactRule in lib/inline-text-redact.ts owns that scaffolding. Each rule file now declares its detection logic — regex patterns (pii-redact), prefix patterns + entropy scoring (secrets-redact), candidate-window decoding (encoded-payload-redact) — and hands id, label, description, minLength, and collectMatches to the factory.

What this changes

• New: extension/src/lib/inline-text-redact.ts (100 LOC) — factory, plus an InlineTextRedactRule type that tightens teardown to non-optional so existing tests can keep calling rule.teardown() directly.
• Migrated: pii-redact (135 → 81), secrets-redact (202 → 153), encoded-payload-redact (350 → 301).
• Net: -52 LOC across the four files. Lifecycle state now lives in a closure rather than at module scope, so a hypothetical hot reload or repeated apply/teardown can't leak stale unsubscribeRouteChange.

Out of scope

• prompt-injection-redact is a text-walker too but a different shape — it inserts a block placeholder against a walked-up container, doesn't use the subtree watcher, and runs a second-pass dedupe via onComplete with filterToOutermost. A future defineBlockTextRedactRule could absorb it if more rules adopt that shape.
• The other two findings from the recent architecture review (Rule.id: RuleId tightening, subtree-watcher decomposition) are deferred to keep this PR focused. The Rule.id tightening in particular would break existing test fixtures that use synthetic ids, so it needs its own treatment.

Test plan

• bun run test — 1354 tests pass (was 1354).
• bun run typecheck — clean.
• bun run check (Biome + ESLint) — clean.
• bun run knip — no unused exports.
• Targeted re-run of pii-redact, secrets-redact, encoded-payload-redact test suites (57 tests) — all green, including the property tests.

🤖 Generated with Claude Code